Gitea setup: Core Rule Set blocks attacks, not ordinary Gitea traffic (closes #198)

The Gitea setup runs the Core Rule Set in block mode. Rules that refused
ordinary Gitea requests are switched off only where they misfired:

- deploy/gitea/crs-exclusions.conf, loaded through the new setting
  SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE, covers Gitea's search, file-name
  and branch-name fields, Referer, and file paths;
- smallwebwaf's defaults gain a seventh change: the registry upload
  path's from parameter skips 932260.

A file that cannot be read, does not parse or names an id from 900000
to 900999 stops servewaf at start. internal/waf's tests and
script/gitea-setup send the recorded requests in
internal/waf/testdata/gitea-requests.txt and three attacks.

Model: opus-5-5

SPEC.md

@@ -36,7 +36,8 @@ to them.
     - the state files;
     - a lookup database;
     - a `SWWAF_` setting given as a file;
-    - the file `SWWAF_LOG_REMOTE_TLS_CA_FILE` names.
+    - the file `SWWAF_LOG_REMOTE_TLS_CA_FILE` names;
+    - the file `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` names.
 
 ## Non-goals
 
@@ -81,7 +82,7 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/waf`: the Core Rule Set, with the six changes listed under
+    - `internal/waf`: the Core Rule Set, with the seven changes listed under
       "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
@@ -325,9 +326,10 @@ Conventions:
   lists: `SWWAF_ADMIN_TOKEN_FILE` names the file that holds `SWWAF_ADMIN_TOKEN`.
   The file's contents are the value, less one newline at the end, and are
   checked as the value itself would be. Setting both forms stops the start, and
-  so does naming a file that cannot be read. `SWWAF_LOG_REMOTE_TLS_CA_FILE`
-  already holds a file name, so it has no `_FILE` form. No `SWRP_` setting has
-  one, since `rproxy` never touches disk.
+  so does naming a file that cannot be read. `SWWAF_LOG_REMOTE_TLS_CA_FILE` and
+  `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` already hold a file name, so they have
+  no `_FILE` form. No `SWRP_` setting has one, since `rproxy` never touches
+  disk.
 - Settings, files included, are read once at start. Changing one means
   restarting the container. The files `servewaf` watches while it runs are its
   state files, its rule files and the lookup database.
@@ -583,6 +585,14 @@ sends it.
     probes these rules caught (see "Rule files"). A list you give replaces the
     default, so name these six ids in it to keep them off.
 
+- `SWWAF_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
+  Coraza directives, which `servewaf` loads after the Core Rule Set and the
+  changes below. An exclusion switches one rule off for some fields or paths
+  only, where `SWWAF_WAF_DISABLED_RULES` switches it off everywhere.
+  `deploy/gitea/crs-exclusions.conf` holds gitea's. The start stops on a file
+  that cannot be read or does not parse. It stops too on a file that names any
+  number from 900000 to 900999, the ids of `smallwebwaf`'s own rules.
+
 - `SWWAF_WAF_BODY_LIMIT` switches body inspection on, up to that size. It takes
   at most `64K`, since `servewaf` gets no more of a body than that (see "The
   answer"). Form data and multipart bodies are read up to the size. JSON and XML
@@ -612,7 +622,7 @@ sends it.
     scanner from an ordinary client. In front of gitea, registry and git clients
     get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in six ways, since in front of
+`smallwebwaf` changes the Core Rule Set 4.25.0 in seven ways, since in front of
 gitea it would otherwise refuse ordinary requests. The changes hold in front of
 every app, and no setting undoes them:
 
@@ -669,6 +679,10 @@ every app, and no setting undoes them:
       must check it itself.
 6. Responses are not inspected. A raw file from a repository, such as a shell
    script, looks to the response rules like source code leaking from the server.
+7. The `from` parameter of a container registry's upload path,
+   `/v2/<image>/blobs/uploads/`, is not checked for command names (932260). A
+   push that reuses a layer names there the image it takes the layer from. An
+   image such as `owner/python3-app` would have that push refused.
 
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.